Skip to main content

​
Platform compatibility

​
Set up the control

1

Go to MDM > Controls > Add new control

Select App blocking.
2

Choose your enforcement mode

  • Monitor: executions of binaries not covered by a rule are allowed. Use this mode to block specific applications while letting everything else run.
  • Lockdown: executions of binaries not covered by a rule are blocked. Use this mode to permit only an explicit list of approved applications.
  • Standalone: executions of binaries not covered by a rule trigger an authorization dialog, letting the employee approve the application themselves.
3

Add applications

Add applications by their bundle identifier (e.g. com.spotify.client) or executable name.
To find an application’s bundle identifier on macOS, run the following command in Terminal:osascript -e 'id of app "AppName"'
4

Select targeting

Choose which devices to apply the control to: all macOS devices, specific device groups, or a custom target.

​
How it works

This control is powered by Santa, an open-source macOS security agent developed by Google. Santa intercepts every binary execution request and evaluates it against the configured rules before allowing or denying it. In Monitor mode, Santa terminates only binaries matching a block rule. In Lockdown mode, Santa terminates any binary without an explicit allow rule. In Standalone mode, binaries without a rule prompt the employee for authorization before launching. When Santa blocks an application, it terminates the process and shows a system notification explaining that the application is not permitted. The control enforces rules continuously — if an employee installs an unapproved application after you apply the control, Santa evaluates it the next time the employee attempts to launch it.

​
Modify or remove the control

Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement but does not remove existing configurations from devices.

​
Troubleshooting

An allowed application is being blocked
  • Double-check the bundle identifier for typos — identifiers are case-sensitive.
  • Confirm the control is targeting the correct device group.
  • Re-check the enforcement mode: in Lockdown, applications without an allow rule are blocked by default. Either switch to Monitor, or add the application to your allow rules.
A blocked application is still running
  • The policy is applied at launch time. If the application was already open when the policy was deployed, restart the device or ask the employee to quit and reopen the application.